burnledger 0.8.1 → 0.9.1

package/README.md

@@ -68,12 +68,154 @@ const key = await publicKeyFromHex("abcdef...", { revoked: false });
 const keys = new Map([[key.keyId, key]]);
 
 const certResult = await verifyCertificate(certificate, keys);
-// "VALID" | "INVALID"
+// "VALID" or a soft key verdict; throws VerificationError on failure
 
 const logResult = await verifyTransparency(certificate, keys);
-// "INCLUDED" | "INVALID" | "NOT_AVAILABLE"
+// "INCLUDED" | "NOT_AVAILABLE"; throws VerificationError on an invalid proof
 ```
 
+Malformed input — a missing field, a value of the wrong JSON type, bytes that
+are neither hex nor base64, a hash or signature of the wrong length — throws
+`VerificationError` too, with a message naming the field
+(`systems[0].query_hash is 31 bytes, expected 32`). A record in a format this
+version cannot read throws it with `code === UNSUPPORTED_FORMAT_VERSION`.
+
+### Requiring a registration
+
+From format 9.0 every system in a record says whether the enclave checked it
+against a registration (`authorization: certified`, with the `customer_key_id`
+it was registered under) or not (`authorization: none`). A `none` record is
+still genuine, and verifies by default: whoever relays requests to the enclave
+can always leave a registration out, and the enclave cannot refuse that. What
+nothing but you can do is refuse the record, so ask for it, naming your key id:
+
+```typescript
+import { AUTHORIZATION_POLICY_FAILED, verifyCertificate } from "burnledger";
+
+await verifyCertificate(certificate, keys, {
+  requireAuthorization: { customerKeyIds: ["cust_k_..."] }, // every system, your key
+});
+```
+
+What a pass means: every required system is `certified` under a key id you
+named, in a record from an enclave image of wire protocol 12 or later — the
+first that registers a system only with the signatures of the key group that id
+names. So that key group signed the registration. Earlier images, which include
+every image that has issued format 9.0 so far, could register a system with no
+customer signature, so a `certified` record from one of them fails the policy,
+and so does a record that names no image. The key id is required for the same
+reason: `certified` under a key you did not name could be under a key group the
+relay enrolled itself.
+
+`systems` narrows the requirement to the system ids you name. A record that does
+not meet the policy throws `VerificationError` with
+`code === AUTHORIZATION_POLICY_FAILED`, naming the reason. A record older than
+9.0 always fails: nothing signs its `authorization` field.
+`verifyCertificateWithStatus` takes the same options as its last argument, and
+the CLI takes `--require-certified` or `--require-certified-system <system_id>`,
+each with `--customer-key-id <id>`.
+
+## Registering a system with your own key
+
+ADR-025 lets a system's Verification Records say `authorization: certified`
+with your `customer_key_id`: before measuring it, the enclave checked that the
+system's config and query are the ones a key group *you* hold registered. That
+holds for records from an enclave image of protocol 12 or later; the verifiers
+say when a record comes from an earlier one, whose `certified` is not evidence.
+All of it happens on your machine, and the SDK never holds or sends a private key.
+Node only: ADR-025 makes a client you run locally the only place enrolment can
+happen, so these calls are not part of the browser entry point.
+
+```typescript
+import { BurnLedger, generateKeyGroup } from "burnledger";
+
+// 1. A key group: n Ed25519 members, any t of which can act.
+const { group, signers } = await generateKeyGroup({ members: 2, threshold: 1 });
+const seeds = signers.map((s) => s.exportSeed()); // store these offline, now
+
+const dp = new BurnLedger({ apiKey: "dp_..." });
+
+// 2. Verify the enclave against the PCR0 you pinned out of band. Configs are
+//    sealed to it, and everything below must come back signed by its key.
+const enclave = await dp.attestEnclaveIdentity({ expectedPcr0: PINNED_PCR0 });
+
+// 3. Enrol the group for your team. Every member signs, over the latest the
+//    authorization may end (`notAfter`, by default the enclave's 90-day maximum).
+await dp.enrollKeyGroup({ teamId: TEAM_ID, group, signers, enclave });
+
+// 4. Seal the config to the enclave, create the system with only the sealed
+//    bytes, and register it, signed at the group's threshold.
+const { system, registration } = await dp.createRegisteredSystem({
+  teamId: TEAM_ID,
+  group,
+  signers: signers.slice(0, 1),
+  enclave,
+  name: "users-db",
+  connectorType: "postgresql",
+  dsn: "postgres://...",
+  subjectQuery: "SELECT id FROM users WHERE email = $1",
+});
+
+// 5. Rotate when you must. The OUTGOING group signs at its threshold and every
+//    incoming member signs; nothing is re-registered.
+const next = await generateKeyGroup({ members: 2, threshold: 1 });
+await dp.rotateKeyGroup({
+  teamId: TEAM_ID,
+  previousGroup: group,
+  previousSigners: signers.slice(0, 1),
+  nextGroup: next.group,
+  nextSigners: next.signers,
+  enclave,
+});
+```
+
+**What each call checks.** The API relays every document, so each one that
+comes back — the enrolment statement, the authorization, the registration — must
+verify under the signing key of the enclave you attested, or the call throws
+`VerificationError`. A relay that forged an enrolment would otherwise have you
+believe you were registered. The key comes from your attestation, not from
+`/.well-known/burnledger-keys`, which the same API serves. Then the enrolment
+must name the group you hold and the team you asked for, its authorization must
+end exactly at the `notAfter` you signed and not start in the future, so an older
+genuine answer or another team's is refused, and the registration must name the
+system, config and connector you signed. `verifyKeyEnrollmentStatement`,
+`verifyTeamAuthorization` and `verifySystemRegistration` re-check a stored
+document against the enclave key.
+Two of the registration's signed fields are deliberately not compared. Its
+`query_template_hash` is HashQuery over the template *after* the server
+normalizes it, while the request signs `sha256` of the raw template, so the two
+are not byte-equal even for an honest registration and the SDK has no normalizer
+to reconcile them. `registered_at` is not freshness-checked either, as there is
+no signed bound to hold it to. So a relay could hand back an older genuine
+registration of this system, under this key and config, over a template you
+signed for it earlier; the customer path calls the check right after its own
+POST, which narrows that window but does not close it.
+
+A signer is anything with a `publicKey` and an async `sign(payload)`
+(`KeyGroupSigner`), so a member can live in an HSM, a cloud KMS or another
+process; `InMemorySigner` is the convenience for keys on this machine. A system
+that already exists is registered with `registerSystemWithKey`, given the exact
+config bytes it was created with.
+
+**What the records then say.** Every Verification Record of a registered system
+carries `authorization: certified` and your `customer_key_id` for it, and the CLI
+prints that key id on the system's Registration line, with what the record's
+enclave image makes of it. A system never registered
+says `authorization: none`. A record naming a key id that is not yours means
+someone else authorized that verification. The authorization behind your key
+expires; enrol the same group again before `authorization.notAfter` to renew it.
+
+**Custody.** The private keys are yours alone: BurnLedger never sees them and
+cannot reissue them. Lose enough members that the group can no longer reach its
+threshold and it can neither register a system nor authorize its own rotation,
+and there is no recovery, because an operator who could re-enrol on your behalf
+is an operator who could mint (ADR-025 §3). The way back is a new group and
+re-registering every system, and records before and after will name different key
+ids, visibly. So enrol more members than the threshold and keep one offline — two
+members, threshold one, is the simplest. A recovery-phrase format is not defined
+yet; until it is, back up each member's 32-byte seed (`exportSeed()`) as you
+would any credential that cannot be reissued.
+
 ## Webhook Verification
 
 Verify incoming webhook signatures (HMAC-SHA256):

package/dist/cjs/anchor.d.ts

@@ -63,9 +63,11 @@ export interface AnchorResult {
  * whether the anchor is consistent would hand that decision to whoever answered
  * the HTTP request.
  *
- * `statement` must already have passed unwrapStatusStatement, which is what
- * guarantees `sth_root_hash` is 32 bytes of hex. That is the boundary check;
- * this function does not repeat it.
+ * The anchor fields are checked here, before anything is asked of the log. The
+ * /verify page passes a statement exactly as the status endpoint served it, and
+ * verifyCertificateWithStatus, which authenticated it, accepts a root spelled as
+ * hex, base64 or bytes. A root that is not hex cannot be read here and says
+ * nothing about the log either way, so the anchor is UNVERIFIED.
  */
 export declare function checkStatementAnchor(crypto: CryptoOps, apiUrl: string, statement: Record<string, unknown>, key: PublicKeyInfo): Promise<AnchorResult>;
 //# sourceMappingURL=anchor.d.ts.map

package/dist/cjs/anchor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anchor.d.ts","sourceRoot":"","sources":["../../src/anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC;AAExE,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAC5C,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAC9C,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAcD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,YAAY,CAAC,CAqFvB"}
+{"version":3,"file":"anchor.d.ts","sourceRoot":"","sources":["../../src/anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC;AAExE,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAC5C,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAC9C,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,YAAY,CAAC,CAyFvB"}

package/dist/cjs/anchor.js

@@ -53,9 +53,11 @@ const REQUEST_TIMEOUT_MS = 10_000;
  * whether the anchor is consistent would hand that decision to whoever answered
  * the HTTP request.
  *
- * `statement` must already have passed unwrapStatusStatement, which is what
- * guarantees `sth_root_hash` is 32 bytes of hex. That is the boundary check;
- * this function does not repeat it.
+ * The anchor fields are checked here, before anything is asked of the log. The
+ * /verify page passes a statement exactly as the status endpoint served it, and
+ * verifyCertificateWithStatus, which authenticated it, accepts a root spelled as
+ * hex, base64 or bytes. A root that is not hex cannot be read here and says
+ * nothing about the log either way, so the anchor is UNVERIFIED.
  */
 async function checkStatementAnchor(crypto, apiUrl, statement, key) {
     const treeSize = statement.sth_tree_size;
@@ -67,6 +69,10 @@ async function checkStatementAnchor(crypto, apiUrl, statement, key) {
     }
     if (treeSize === 0)
         return unverified("the statement names no log head to anchor to");
+    const root = statement.sth_root_hash;
+    if (typeof root !== "string" || !/^[0-9a-fA-F]{64}$/.test(root)) {
+        return unverified("the statement's anchored root hash is not 32 bytes of hex");
+    }
     let head;
     try {
         head = await fetchLogHead(apiUrl);
@@ -87,7 +93,7 @@ async function checkStatementAnchor(crypto, apiUrl, statement, key) {
     }
     const headSize = head.tree_size;
     const headRoot = (0, verify_js_1.hexToBytes)(head.root_hash);
-    const statementRoot = (0, verify_js_1.hexToBytes)(statement.sth_root_hash);
+    const statementRoot = (0, verify_js_1.hexToBytes)(root);
     // A head SMALLER than one the same issuer signed into a statement means the
     // log went backwards. An append-only structure cannot do that, so this needs
     // no proof to refuse.

package/dist/cjs/anchor.js.map

@@ -1 +1 @@
-{"version":3,"file":"anchor.js","sourceRoot":"","sources":["../../src/anchor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;;AAGH,2CAMqB;AAkBR,QAAA,gBAAgB,GAAG,WAAW,CAAC;AAC/B,QAAA,iBAAiB,GAAG,YAAY,CAAC;AACjC,QAAA,mBAAmB,GAAG,cAAc,CAAC;AAOlD;;gFAEgF;AAChF,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,CAAC;AAEnC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAOlC;;;;;;;;;;;GAWG;AACI,KAAK,+BACV,MAAiB,EACjB,MAAc,EACd,SAAkC,EAClC,GAAkB;IAElB,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpF,qEAAqE;QACrE,4EAA4E;QAC5E,wEAAwE;QACxE,OAAO,UAAU,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,8CAA8C,CAAC,CAAC;IAEtF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,gCAAgC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,WAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,WAAW,GAAG,IAAA,gCAAoB,EAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,2CAA2C,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,IAAA,sBAAU,EAAC,IAAI,CAAC,SAAmB,CAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAU,CACf,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAmB,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAA,sBAAU,EAAC,IAAI,CAAC,SAAmB,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,IAAA,sBAAU,EAAC,SAAS,CAAC,aAAuB,CAAC,CAAC;IAEpE,4EAA4E;IAC5E,6EAA6E;IAC7E,sBAAsB;IACtB,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,QAAA,mBAAmB;YAC5B,MAAM,EACJ,0CAA0C,QAAQ,6BAA6B;gBAC/E,GAAG,QAAQ,uCAAuC;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,2EAA2E;QAC3E,2EAA2E;QAC3E,wCAAwC;QACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE,QAAA,mBAAmB;gBAC5B,MAAM,EACJ,4CAA4C,QAAQ,IAAI;oBACxD,GAAG,IAAA,sBAAU,EAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;oBAC7D,GAAG,IAAA,sBAAU,EAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,QAAA,gBAAgB;YACzB,MAAM,EAAE,2DAA2D,QAAQ,GAAG;SAC/E,CAAC;IACJ,CAAC;IAED,IAAI,KAAmB,CAAC;IACxB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,uCAAuC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,6BAAiB,EAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO;YACL,OAAO,EAAE,QAAA,mBAAmB;YAC5B,MAAM,EACJ,kCAAkC,QAAQ,mCAAmC;gBAC7E,GAAG,QAAQ,qDAAqD;SACnE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,QAAA,gBAAgB;QACzB,MAAM,EACJ,+BAA+B,QAAQ,uCAAuC;YAC9E,2BAA2B,QAAQ,GAAG;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,EAAE,OAAO,EAAE,QAAA,iBAAiB,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAClC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAClC,uEAAuE;IACvE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,CAAC;QACH,IAAA,2BAAe,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,MAAc,EACd,OAAe,EACf,OAAe;IAEf,MAAM,GAAG,GACP,GAAG,IAAI,CAAC,MAAM,CAAC,sCAAsC,OAAO,aAAa,OAAO,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,IAAA,sBAAU,EAAC,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;0EAC0E;AAC1E,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC5E,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,KAAK,eAAe,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED;;;gFAGgF;AAChF,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;0DAE0D;AAC1D,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,kBAAkB,QAAQ,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"anchor.js","sourceRoot":"","sources":["../../src/anchor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;;AAGH,2CAMqB;AAkBR,QAAA,gBAAgB,GAAG,WAAW,CAAC;AAC/B,QAAA,iBAAiB,GAAG,YAAY,CAAC;AACjC,QAAA,mBAAmB,GAAG,cAAc,CAAC;AAOlD;;gFAEgF;AAChF,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,CAAC;AAEnC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAOlC;;;;;;;;;;;;;GAaG;AACI,KAAK,+BACV,MAAiB,EACjB,MAAc,EACd,SAAkC,EAClC,GAAkB;IAElB,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpF,qEAAqE;QACrE,4EAA4E;QAC5E,wEAAwE;QACxE,OAAO,UAAU,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,8CAA8C,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,UAAU,CAAC,2DAA2D,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,gCAAgC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,WAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,WAAW,GAAG,IAAA,gCAAoB,EAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,2CAA2C,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,IAAA,sBAAU,EAAC,IAAI,CAAC,SAAmB,CAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAU,CACf,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAmB,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAA,sBAAU,EAAC,IAAI,CAAC,SAAmB,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,IAAA,sBAAU,EAAC,IAAI,CAAC,CAAC;IAEvC,4EAA4E;IAC5E,6EAA6E;IAC7E,sBAAsB;IACtB,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,QAAA,mBAAmB;YAC5B,MAAM,EACJ,0CAA0C,QAAQ,6BAA6B;gBAC/E,GAAG,QAAQ,uCAAuC;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,2EAA2E;QAC3E,2EAA2E;QAC3E,wCAAwC;QACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE,QAAA,mBAAmB;gBAC5B,MAAM,EACJ,4CAA4C,QAAQ,IAAI;oBACxD,GAAG,IAAA,sBAAU,EAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;oBAC7D,GAAG,IAAA,sBAAU,EAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,QAAA,gBAAgB;YACzB,MAAM,EAAE,2DAA2D,QAAQ,GAAG;SAC/E,CAAC;IACJ,CAAC;IAED,IAAI,KAAmB,CAAC;IACxB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,uCAAuC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,6BAAiB,EAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO;YACL,OAAO,EAAE,QAAA,mBAAmB;YAC5B,MAAM,EACJ,kCAAkC,QAAQ,mCAAmC;gBAC7E,GAAG,QAAQ,qDAAqD;SACnE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,QAAA,gBAAgB;QACzB,MAAM,EACJ,+BAA+B,QAAQ,uCAAuC;YAC9E,2BAA2B,QAAQ,GAAG;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,EAAE,OAAO,EAAE,QAAA,iBAAiB,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAClC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAClC,uEAAuE;IACvE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,CAAC;QACH,IAAA,2BAAe,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,MAAc,EACd,OAAe,EACf,OAAe;IAEf,MAAM,GAAG,GACP,GAAG,IAAI,CAAC,MAAM,CAAC,sCAAsC,OAAO,aAAa,OAAO,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,IAAA,sBAAU,EAAC,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;0EAC0E;AAC1E,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC5E,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,KAAK,eAAe,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED;;;gFAGgF;AAChF,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;0DAE0D;AAC1D,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,kBAAkB,QAAQ,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC"}

package/dist/cjs/client.d.ts

@@ -4,7 +4,12 @@
  * Pagination uses AsyncIterable<T> via Paginator.
  */
 import type { ApiKeyListItem, ApiKeyResponse, Attestation, BatchAttestationResponse, BatchRevokeResponse, CertificateResponse, CertificateStats, ConsistencyProof, InclusionProof, LogEntry, Profile, RevocationStatus, SignedTreeHead, System, SystemHealth, VerifyResult, Webhook, WebhookDelivery, WebhookRotateResponse } from "./models.js";
+import type { KeyEnrollmentResult, SystemRegistrationCertificate } from "./models.js";
 import { Paginator } from "./pagination.js";
+import type { CustomerKeyGroup } from "./customer-keys.js";
+import type { EnclavePinOptions, RegisteredSystem } from "./enclave-registration.js";
+import type { EnclaveIdentity } from "./enclave-seal.js";
+import type { KeyGroupSigner } from "./key-group.js";
 export interface BurnLedgerOptions {
     apiKey: string;
     baseUrl?: string;
@@ -33,6 +38,13 @@ export declare class BurnLedger {
         connectionConfig?: Record<string, unknown>;
         dsn?: string;
         uri?: string;
+        /**
+         * The connection config already sealed to the enclave — by
+         * sealConnectionConfig, or by createRegisteredSystem, which does it for you.
+         * The API relays these bytes and cannot open them. Instead of
+         * connectionConfig/dsn/uri, never beside them.
+         */
+        sealedConnectionConfig?: Uint8Array;
         subjectQuery: string;
         hashScope?: string;
         /** The system holds data you treat as PHI. Makes the default proof mode
@@ -125,6 +137,89 @@ export declare class BurnLedger {
         email: string;
     }): Promise<Profile>;
     deleteMe(): Promise<void>;
+    /**
+     * Verify the enclave: `GET /v1/enclave/attestation` over a 32-byte challenge
+     * drawn here (or `pin.nonce`), checked against the PCR0 you pinned out of band.
+     * Returns the keys the document binds. Throws EnclaveAttestationError on
+     * anything short of a document from the pinned image answering this challenge.
+     * Pass the result as `enclave` to the calls below: configs are sealed to it,
+     * and every document they return must verify under its signing key.
+     */
+    attestEnclaveIdentity(pin: EnclavePinOptions): Promise<EnclaveIdentity>;
+    /**
+     * Enrol a key group for your team (ENROLL_KEY). Every member signs; the private
+     * keys stay with the signers. `notAfter` is the latest the authorization may
+     * end, signed by every member so a relayed copy of this request cannot renew
+     * it; it defaults to the enclave's 90-day maximum. Throws VerificationError
+     * unless both documents that come back verify under `enclave`'s signing key,
+     * name exactly this group — ADR-025 §2's one comparison — and your team, end
+     * exactly at `notAfter` and do not start after `now` (this machine's clock by default).
+     */
+    enrollKeyGroup(opts: {
+        teamId: string;
+        group: CustomerKeyGroup;
+        signers: readonly KeyGroupSigner[];
+        enclave: EnclaveIdentity;
+        notAfter?: Date;
+        /** The time to judge the answer's not_before against. Defaults to now. */
+        now?: Date;
+    }): Promise<KeyEnrollmentResult>;
+    /**
+     * Replace an enrolled group with another (ROTATE_KEY). The OUTGOING group
+     * signs at its threshold and EVERY incoming member signs, over the same
+     * request and `notAfter`. Systems registered under the old group keep working
+     * through the link this issues; nothing is re-registered. The answer is checked
+     * as `enrollKeyGroup`'s is, and must also link to the outgoing group.
+     */
+    rotateKeyGroup(opts: {
+        teamId: string;
+        previousGroup: CustomerKeyGroup;
+        previousSigners: readonly KeyGroupSigner[];
+        nextGroup: CustomerKeyGroup;
+        nextSigners: readonly KeyGroupSigner[];
+        enclave: EnclaveIdentity;
+        notAfter?: Date;
+        /** The time to judge the answer's not_before against. Defaults to now. */
+        now?: Date;
+    }): Promise<KeyEnrollmentResult>;
+    /**
+     * Register an existing system under your key group (REGISTER_SYSTEM), signed at
+     * the group's threshold. `config` must be the exact bytes submitted when the
+     * system was created, and `queryTemplate` the system's subject query exactly.
+     * The registration that comes back must verify under `enclave`'s signing key.
+     */
+    registerSystemWithKey(opts: {
+        teamId: string;
+        group: CustomerKeyGroup;
+        signers: readonly KeyGroupSigner[];
+        enclave: EnclaveIdentity;
+        systemId: string;
+        config: Uint8Array | string;
+        queryTemplate: string;
+        connectorType: string;
+    }): Promise<SystemRegistrationCertificate>;
+    /**
+     * ADR-025's whole customer path for a new system: seal the config to `enclave`
+     * (from {@link attestEnclaveIdentity}), create the system with only the sealed
+     * bytes, and register it under your key group.
+     */
+    createRegisteredSystem(opts: {
+        teamId: string;
+        group: CustomerKeyGroup;
+        signers: readonly KeyGroupSigner[];
+        enclave: EnclaveIdentity;
+        name: string;
+        connectorType: string;
+        connectionConfig?: Record<string, unknown>;
+        dsn?: string;
+        uri?: string;
+        subjectQuery: string;
+        hashScope?: string;
+        phiInScope?: boolean;
+        maxRecords?: number;
+        maxBytes?: number;
+        queryTimeout?: string;
+    }): Promise<RegisteredSystem>;
     getSystemHealth(systemId: string): Promise<SystemHealth>;
     getLogHead(): Promise<SignedTreeHead>;
     getLogEntry(index: number): Promise<LogEntry>;

package/dist/cjs/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,OAAO,EACP,gBAAgB,EAChB,cAAc,EACd,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,eAAe,EACf,qBAAqB,EACtB,MAAM,aAAa,CAAC;AAsBrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;0EAC0E;AAC1E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IAEtC,YAAY,IAAI,EAAE,iBAAiB,EAQlC;IAED,KAAK,IAAI,IAAI,CAGZ;IAED,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrC;IAIK,cAAc,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB;;sDAE8C;QAC9C,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBlB;IAEK,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjD;IAED,WAAW,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAIxD;IAEK,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;IAEK,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMnD;IAIK,MAAM,CACV,iBAAiB,EAAE,MAAM,EACzB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GACA,OAAO,CAAC,WAAW,CAAC,CAatB;IAEK,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAMhE;IAEK,OAAO,CACX,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC,WAAW,CAAC,CAQtB;IAEK,MAAM,CACV,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,MAAM,EACzB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC,YAAY,CAAC,CA4BvB;IAEK,WAAW,CAAC,IAAI,EAAE;QACtB,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAWpC;IAIK,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAMxE;IAED,gBAAgB,CAAC,IAAI,CAAC,EAAE;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAOjC;IAEK,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAK5D;IAEK,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAEK,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAM1E;IAEK,iBAAiB,CACrB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAO9B;IAED;4EACwE;IAClE,uBAAuB,CAC3B,cAAc,EAAE,MAAM,EAAE,EACxB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAc9B;IAEK,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAGrD;IAEK,kBAAkB,CAAC,IAAI,CAAC,EAAE;QAC9B,MAAM,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;QACzB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;QAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAUtB;IAIK,eAAe,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAK7D;IAED,YAAY,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAI1D;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAEK,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAM3E;IAEK,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5D;IAED,oBAAoB,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,eAAe,CAAC,CAO1E;IAEK,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKrD;IAEK,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKvD;IAID,WAAW,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,cAAc,CAAC,CAOhE;IAED;;;6EAGyE;IACnE,YAAY,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAKxE;IAEK,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAIK,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,CAG9B;IAED;wEACoE;IAC9D,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAKxE;IAEK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAE9B;IAIK,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAM7D;IAIK,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC,CAK1C;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAOlD;IAEK,aAAa,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAMtB;IAEK,iBAAiB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,cAAc,CAAC,CAU1B;IAEK,mBAAmB,CAAC,IAAI,EAAE;QAC9B,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU5B;CACF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,OAAO,EACP,gBAAgB,EAChB,cAAc,EACd,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,eAAe,EACf,qBAAqB,EACtB,MAAM,aAAa,CAAC;AAsBrB,OAAO,KAAK,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAO5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;0EAC0E;AAC1E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IAEtC,YAAY,IAAI,EAAE,iBAAiB,EAQlC;IAED,KAAK,IAAI,IAAI,CAGZ;IAED,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrC;IAIK,cAAc,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb;;;;;WAKG;QACH,sBAAsB,CAAC,EAAE,UAAU,CAAC;QACpC,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB;;sDAE8C;QAC9C,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;IAEK,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjD;IAED,WAAW,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAIxD;IAEK,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;IAEK,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMnD;IAIK,MAAM,CACV,iBAAiB,EAAE,MAAM,EACzB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GACA,OAAO,CAAC,WAAW,CAAC,CAatB;IAEK,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAMhE;IAEK,OAAO,CACX,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC,WAAW,CAAC,CAQtB;IAEK,MAAM,CACV,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,MAAM,EACzB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC,YAAY,CAAC,CA4BvB;IAEK,WAAW,CAAC,IAAI,EAAE;QACtB,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAWpC;IAIK,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAMxE;IAED,gBAAgB,CAAC,IAAI,CAAC,EAAE;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAOjC;IAEK,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAK5D;IAEK,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAEK,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAM1E;IAEK,iBAAiB,CACrB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAO9B;IAED;4EACwE;IAClE,uBAAuB,CAC3B,cAAc,EAAE,MAAM,EAAE,EACxB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAc9B;IAEK,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAGrD;IAEK,kBAAkB,CAAC,IAAI,CAAC,EAAE;QAC9B,MAAM,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;QACzB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;QAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAUtB;IAIK,eAAe,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAK7D;IAED,YAAY,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAI1D;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAEK,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAM3E;IAEK,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5D;IAED,oBAAoB,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,eAAe,CAAC,CAO1E;IAEK,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKrD;IAEK,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKvD;IAID,WAAW,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,cAAc,CAAC,CAOhE;IAED;;;6EAGyE;IACnE,YAAY,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAKxE;IAEK,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAIK,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,CAG9B;IAED;wEACoE;IAC9D,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAKxE;IAEK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAE9B;IAWD;;;;;;;OAOG;IACG,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAQ5E;IAED;;;;;;;;OAQG;IACG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,gBAAgB,CAAC;QACxB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;QACnC,OAAO,EAAE,eAAe,CAAC;QACzB,QAAQ,CAAC,EAAE,IAAI,CAAC;QAChB,0EAA0E;QAC1E,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAY/B;IAED;;;;;;OAMG;IACG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,gBAAgB,CAAC;QAChC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;QAC3C,SAAS,EAAE,gBAAgB,CAAC;QAC5B,WAAW,EAAE,SAAS,cAAc,EAAE,CAAC;QACvC,OAAO,EAAE,eAAe,CAAC;QACzB,QAAQ,CAAC,EAAE,IAAI,CAAC;QAChB,0EAA0E;QAC1E,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAY/B;IAED;;;;;OAKG;IACG,qBAAqB,CAAC,IAAI,EAAE;QAChC,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,gBAAgB,CAAC;QACxB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;QACnC,OAAO,EAAE,eAAe,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAWzC;IAED;;;;OAIG;IACG,sBAAsB,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,gBAAgB,CAAC;QACxB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;QACnC,OAAO,EAAE,eAAe,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyB5B;IAIK,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAM7D;IAIK,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC,CAK1C;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAOlD;IAEK,aAAa,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAMtB;IAEK,iBAAiB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,cAAc,CAAC,CAU1B;IAEK,mBAAmB,CAAC,IAAI,EAAE;QAC9B,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU5B;CACF"}